Lucene search

K
patchstackDhabaleshwar DasPATCHSTACK:4B53DB48F4F709A754F36DCB8FEAE9B8
HistoryApr 05, 2024 - 12:00 a.m.

WordPress Hello Elementor Theme <= 3.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

2024-04-0500:00:00
Dhabaleshwar Das
patchstack.com
1
wordpress
hello elementor
theme
csrf
vulnerability
version 3.0.0
fixed
owasp top 10
broken access control
cross site request forgery
cve-2024-31289
patch
low priority
cvss severity 4.3
developer
unauthenticated privilege
published
dhabaleshwar das

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.7

Confidence

High

Software

Hello Elementor

Type

Theme

Vulnerable versions

<= 3.0.0

Fixed in

3.0.1

OWASP Top 10

A1: Broken Access Control

Classification

Cross Site Request Forgery (CSRF)

CVE

CVE-2024-31289

Patch priority

Low

CVSS severity

Low (4.3)

Developer

Claim ownership

PSID

8b6c120716f6

Credits

Dhabaleshwar Das Dhabaleshwar Das

Required privilege

Unauthenticated

Published

5 April, 2024

Remove and replace plugin Expand full details Have additional information or questions about this entry? Let us know.

Solution

This security issue has a low severity impact and is unlikely to be exploited.

Affected configurations

Vulners
Node
-hello_elementorRange3.0.0
VendorProductVersionCPE
-hello_elementor*cpe:2.3:a:-:hello_elementor:*:*:*:*:*:*:*:*

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

6.7

Confidence

High

Related for PATCHSTACK:4B53DB48F4F709A754F36DCB8FEAE9B8